fix: redact reflector stderr on failure

[brannn]

Summary

• redact reflector subprocess stderr before including it in returned errors
• keep redacted stderr context available for debugging
• add a regression test for reflector failure stderr redaction

Test Plan

• go test ./internal/reflector -count=1
• go test ./...
• git diff --check